Amplify detects every push to main and triggers a full build. The build spec (amplify.yml) runs npm ci and npm run build, then Amplify deploys the Next.js output behind CloudFront automatically. No manual deploy steps.

• Auto-deploy on push to main
• Build spec: amplify.yml
• Next.js SSR support via Amplify Hosting
• Environment variables for CDN URL injection

The photo CDN infrastructure is provisioned with Terraform: a private S3 bucket and a CloudFront distribution connected via Origin Access Control (OAC). The bucket is never publicly accessible — CloudFront is the only allowed reader, scoped by AWS:SourceArn in the bucket policy.

• S3 bucket: private, public access fully blocked
• CloudFront OAC: sigv4 signing, replaces legacy OAI
• Bucket policy: scoped to CloudFront distribution ARN
• 1-year immutable cache TTL, brotli + gzip compression
• PriceClass_100: US, Canada, Europe

Portfolio photos are stored in S3 and served via a dedicated CloudFront distribution, separate from the app hosting. This keeps large binary assets out of the deployment pipeline while giving photos their own long-lived cache headers (max-age=31536000, immutable).

• Photos uploaded via scripts/upload-photos.sh
• Cache-Control: public, max-age=31536000, immutable
• CloudFront invalidation on re-upload
• NEXT_PUBLIC_PHOTO_CDN_URL injected at build time

App Router with per-route server and client components. Dynamic case study routes (/projects/[id] and /experience/[slug]) are server components that resolve params and pass them to client content components. Turbopack handles local development. Rajdhani + Geist fonts via next/font.

• App Router: server components by default
• Dynamic routes: instant = false for params resolution
• Turbopack: local dev HMR
• next/font: Rajdhani (headings), Geist Sans/Mono
• TypeScript strict mode throughout